binaryen

binaryen copied to clipboard

Fuzz bug: missing bounds checks in element segment instantiation

1

V8 very reasonably fails to instantiate this module: ``` (module (table $0 1 funcref) (elem $0 (offset (i32.sub (i32.const 0) (i32.const 1)))) ) ``` But our interpreter does not perform...

tlively

Emitting unreachable for unemittable String instructions can fail due to blocks

2

https://github.com/WebAssembly/binaryen/pull/6415 solves most of the problem (see details there), but an exception is this: ```wat (string.new_wtf16_array (ref.as_non_null (block (result (ref null $array)) (ref.as_non_null (ref.null none) ) ) ) (i32.const 0)...

kripken

SafeHeap: Handle overflows when adding the pointer and the size

7

E.g. loading `4` bytes from `2^32 - 2` should error: `2` bytes are past the maximum address. Before this PR we added `2^32 - 2 + 4` and overflowed to...

kripken

Impossible address ranges in DWARF debug info

1

I've been working on a tool that parses DWARF debug info embedded in WebAssembly binaries. The files I'm examining are optimized for size using `wasm-opt -Oz -g`. I've run into...

datagore

Allow --keepfuncs and --splitfuncs to be use alongside a profile data

8

There are times after collecting a profile, we wish to manually include specific functions into the primary module. It could be due to non-deterministic profiling or functions for error scenarios...

Mintyboi

Make br_if with a value's type match the spec

6

Previously `br_if` with a value had the same type as the value, but the spec says it should be the type of the block it targets, which might be less...

kripken

wasm-opt: "compile unit size was incorrect"

3

I'm unsure what exactly triggers this issue, but I tried several versions: v112, v116, v117, they all fail with the same message: ``` compile unit size was incorrect (this may...

daxpedda

This just bisects on the binary in order to find where the behavior changes. This is useful on our fuzzer as the input is additive, so just by shrinking it...

kripken

Print out callgraph of a specific entry point

2

Allows us to generate / print out a callgraph for a specific entry point which we'd like to focus on. Sample usage: `wasm-opt foobar.wasm --print-call-graph -pa=callgraph-entry@foo > foo.dot`

Mintyboi

wasm-opt wasm port performance

3

This issue is about porting wasm-opt itself to wasm, and how fast it runs there. The main blocker here was that it was 10x slower than a native build: https://github.com/emscripten-core/emscripten/issues/15727...

kripken